NHS Digital is a controller under the UK General Data Protection Regulation (GDPR) of the health data we share with ONS. We share health data with ONS for statistical purposes under Section 45A and 45C of the Statistics and Registration Service Act 2007 (SRSA).
Under GDPR, we share health data with ONS under:
- Article 6(1)(e) – as processing is necessary for the performance of a task carried out in the public interest, under the SRSA.
- Article 9(2)(g) – as processing is necessary for reasons of substantial public interest. We consider it is substantially in the public interest to permit ONS to process and share health data for its statistical functions and to promote and enable statistical research for COVID-19 purposes through processing the health data to create the Research Database and make anonymous data available to Approved Researchers. We also rely on Paragraph 6 of Part 2 of Schedule 1 of the Data Protection Act 2018 (DPA18) as processing is necessary for statutory and government etc purposes.
- Article 9(2)(j) – as processing is necessary for statistical and research purposes under the SRSA. We also rely on Paragraph 4 of Part 1 of Schedule 1 of the DPA18 as processing is necessary for statistical and research etc purposes.
ONS is a controller under GDPR of the health data we share with it. It is also a controller for the other personal data it processes for statistical purposes and is the controller for the Research Database.
ONS processes health data we share with it for statistical purposes under Section 45A and Section 45C of the SRSA. It creates the Research Database using its powers under Section 23 and 38 of the SRSA. It grants access to the Research Database by Approved Researchers under Section 39(4)(i) of the SRSA. NHS Digital must however consent to this access under Section 45A and Section 45E of the SRSA. NHS Digital is a joint controller with ONS in relation to the giving of this consent.
Under GDPR, ONS processes the health data and other personal data to create the Research Database and to provide Approved Researchers with access to it under:
- Article 6(1)(e) - public task, under the SRSA, and
- Article 9(2)(j) - processing for statistical and research purposes, together with Paragraph 4 of Part 1 of Schedule 1 of the DPA18 - research etc.
National Data Opt Outs
The National Data Opt Out does not apply to the health data we share with ONS for their own statistical purposes, as this purpose is exempt under the National Data Opt Out Policy.
ONS however remove identifiable information from the health data we have shared with them when they create the Research Database, and they only ever share anonymous data with Approved Researchers. The National Data Opt Out does not apply to anonymous information which is used for research purposes, as it can no longer identify you.